lkml.org 
[lkml]   [2010]   [Jan]   [5]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[29/39] x86/ptrace: make genregs[32]_get/set more robust
    2.6.31-stable review patch.  If anyone has any objections, please let us know.

    ------------------

    From: Linus Torvalds <torvalds@linux-foundation.org>

    commit 04a1e62c2cec820501f93526ad1e46073b802dc4 upstream.

    The loop condition is fragile: we compare an unsigned value to zero, and
    then decrement it by something larger than one in the loop. All the
    callers should be passing in appropriately aligned buffer lengths, but
    it's better to just not rely on it, and have some appropriate defensive
    loop limits.

    Acked-by: Roland McGrath <roland@redhat.com>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

    ---
    arch/x86/kernel/ptrace.c | 16 ++++++++--------
    1 file changed, 8 insertions(+), 8 deletions(-)

    --- a/arch/x86/kernel/ptrace.c
    +++ b/arch/x86/kernel/ptrace.c
    @@ -417,14 +417,14 @@ static int genregs_get(struct task_struc
    {
    if (kbuf) {
    unsigned long *k = kbuf;
    - while (count > 0) {
    + while (count >= sizeof(*k)) {
    *k++ = getreg(target, pos);
    count -= sizeof(*k);
    pos += sizeof(*k);
    }
    } else {
    unsigned long __user *u = ubuf;
    - while (count > 0) {
    + while (count >= sizeof(*u)) {
    if (__put_user(getreg(target, pos), u++))
    return -EFAULT;
    count -= sizeof(*u);
    @@ -443,14 +443,14 @@ static int genregs_set(struct task_struc
    int ret = 0;
    if (kbuf) {
    const unsigned long *k = kbuf;
    - while (count > 0 && !ret) {
    + while (count >= sizeof(*k) && !ret) {
    ret = putreg(target, pos, *k++);
    count -= sizeof(*k);
    pos += sizeof(*k);
    }
    } else {
    const unsigned long __user *u = ubuf;
    - while (count > 0 && !ret) {
    + while (count >= sizeof(*u) && !ret) {
    unsigned long word;
    ret = __get_user(word, u++);
    if (ret)
    @@ -1223,14 +1223,14 @@ static int genregs32_get(struct task_str
    {
    if (kbuf) {
    compat_ulong_t *k = kbuf;
    - while (count > 0) {
    + while (count >= sizeof(*k)) {
    getreg32(target, pos, k++);
    count -= sizeof(*k);
    pos += sizeof(*k);
    }
    } else {
    compat_ulong_t __user *u = ubuf;
    - while (count > 0) {
    + while (count >= sizeof(*u)) {
    compat_ulong_t word;
    getreg32(target, pos, &word);
    if (__put_user(word, u++))
    @@ -1251,14 +1251,14 @@ static int genregs32_set(struct task_str
    int ret = 0;
    if (kbuf) {
    const compat_ulong_t *k = kbuf;
    - while (count > 0 && !ret) {
    + while (count >= sizeof(*k) && !ret) {
    ret = putreg32(target, pos, *k++);
    count -= sizeof(*k);
    pos += sizeof(*k);
    }
    } else {
    const compat_ulong_t __user *u = ubuf;
    - while (count > 0 && !ret) {
    + while (count >= sizeof(*u) && !ret) {
    compat_ulong_t word;
    ret = __get_user(word, u++);
    if (ret)



    \
     
     \ /
      Last update: 2010-01-05 21:13    [W:0.025 / U:0.036 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site